« Volver al listado

CVE-2026-42209

Estado: AplazadaMedia (6.5)—

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Flashmq — FlashmqAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42209",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42209",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-11T15:59:23.887272Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "halfgaar",
          "product": "FlashMQ",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.26.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-08T22:16:32.103",
  "references": [
    {
      "url": "https://github.com/halfgaar/FlashMQ/commit/193b6e7767889511cfa8e933908ea5e6a1077a1f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/halfgaar/FlashMQ/issues/167",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/halfgaar/FlashMQ/releases/tag/v1.26.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-2789-vfcg-5922",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/halfgaar/FlashMQ/issues/167",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-369"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.1, a remote client with retained publish permission can crash the FlashMQ broker when both set_retained_message_defer_timeout and set_retained_message_defer_timeout_spread are configured to non-default values, resulting in denial of service. If anonymous retained publishing is allowed, no authentication is required; otherwise, the attacker needs the corresponding publish permission. This issue has been patched in version 1.26.1."
    }
  ],
  "lastModified": "2026-06-17T10:47:30.937",
  "sourceIdentifier": "security-advisories@github.com"
}